CVE-2019-1068

What is Microsoft SQL Server?

Microsoft SQL Server is one of the most widely deployed enterprise relational database platforms, running the SQL Server Database Engine (sqlservr.exe) as a Windows service that typically holds broad access to the host and to the data it stores. Because databases sit at the center of most application stacks and are frequently reachable from web and application tiers, remote code execution in the Database Engine gives an attacker a direct path to sensitive data and to lateral movement within an environment.

Overview

CVE-2019-1068 is a remote code execution vulnerability in the Microsoft SQL Server Database Engine caused by improper handling of a specially crafted function call / query request. An attacker who can authenticate to a vulnerable SQL Server instance and submit a malicious request can trigger memory corruption and execute arbitrary code in the security context of the SQL Server Database Engine service account. Because that service account is often privileged, successful exploitation can lead to full compromise of the database host.

Microsoft patched the flaw in the July 2019 Patch Tuesday release. CISA added it to the KEV catalog in August 2026 with a notably short remediation deadline, indicating confirmed active exploitation.

Affected Versions

Consult the Microsoft Security Update Guide for the exact GDR/CU build numbers that correspond to each servicing branch.

Technical Details

The vulnerability is a memory-corruption / RCE flaw in the Database Engine's handling of a crafted request. Exploitation requires the attacker to authenticate (PR:L) — any principal that can connect and issue queries is sufficient — but no user interaction and low attack complexity are needed once authenticated (AV:N/AC:L/UI:N). Code executes in the context of the Database Engine service account rather than the connecting user's low-privilege session, which is what elevates this from a data-access issue to host compromise. Environments that expose SQL Server directly to untrusted networks, or that grant broad login access, are at greatest risk.

Discovery

The vulnerability was reported to Microsoft through coordinated disclosure and fixed in the July 2019 security updates. Microsoft credits the reporting researcher in its Security Update Guide advisory; no public in-the-wild exploitation was reported at the time of the original patch.

Exploitation Context

CISA's August 2026 KEV listing — accompanied by an unusually tight remediation deadline — reflects evidence of active exploitation of unpatched SQL Server 2014/2016/2017 instances. The most exposed targets are servers reachable from the network with weak or shared SQL logins, or instances embedded in application stacks where an attacker who has compromised the application tier can authenticate to the database and pivot to code execution on the database host.

Remediation

1. Apply the July 2019 (or any later) Microsoft security update for your SQL Server servicing branch. Because cumulative updates are, well, cumulative, any current CU/GDR build already includes this fix — bring instances up to a supported, patched build.
2. Upgrade unsupported instances (SQL Server 2014 and 2016 are out of, or nearing the end of, extended support) to a supported version that still receives security fixes.
3. Restrict network exposure — SQL Server should not be reachable from the internet; place it behind firewalls and restrict access to application and admin subnets only.
4. Enforce least-privilege SQL logins and run the Database Engine service under a low-privileged, dedicated account rather than a highly privileged domain account, limiting the blast radius of RCE.
5. Review authentication and query logs for anomalous logins and unexpected activity from the Database Engine service account, and hunt for signs of post-exploitation lateral movement.